After she left, she logged in with the still-unchanged root password and trashed our systems. And it turned out the last few "backups" she made were blank.

Damn, if only you had made security escort her out like a criminal without dignity....absolutely nothing would have been different! You had no idea she wasn't making backups, rent-a-cops wouldn't change that. You had no idea the other admins were incompetent, rent-a-cops wouldn't change that either.

She left you a mountain of evidence against her, effectively guaranteeing she'll never work again for reasons no one can guess and were completely unreasonable. That's not really a COMMON scenario we all must prepare for in policy and SOP.

This is similar to suggesting that we need a policy to strip-search people in public for fear they might be smuggling snukes up their snizz.